From d74b59b13208fa9508baaf5a1a5172fecad321ae Mon Sep 17 00:00:00 2001 From: Stephen Gallagher Date: Wed, 5 Oct 2011 15:58:15 -0400 Subject: HBAC: Use originalMember for identifying servicegroups --- src/providers/ipa/ipa_hbac_common.c | 96 +++++++++++++++++------------- src/providers/ipa/ipa_hbac_private.h | 5 ++ src/providers/ipa/ipa_hbac_services.c | 109 ++++++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+), 41 deletions(-) diff --git a/src/providers/ipa/ipa_hbac_common.c b/src/providers/ipa/ipa_hbac_common.c index 56c851b1..7a614c31 100644 --- a/src/providers/ipa/ipa_hbac_common.c +++ b/src/providers/ipa/ipa_hbac_common.c @@ -405,7 +405,7 @@ static errno_t hbac_eval_service_element(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, struct sss_domain_info *domain, - const char *hostname, + const char *servicename, struct hbac_request_element **svc_element); static errno_t @@ -588,18 +588,18 @@ static errno_t hbac_eval_service_element(TALLOC_CTX *mem_ctx, struct sysdb_ctx *sysdb, struct sss_domain_info *domain, - const char *hostname, + const char *servicename, struct hbac_request_element **svc_element) { errno_t ret; - size_t i, count; + size_t i, j, count; TALLOC_CTX *tmp_ctx; struct hbac_request_element *svc; struct ldb_message **msgs; - const char *group_name; + struct ldb_message_element *el; struct ldb_dn *svc_dn; - const char *attrs[] = { IPA_CN, NULL }; - const char *service_filter; + const char *memberof_attrs[] = { SYSDB_ORIG_MEMBEROF, NULL }; + char *name; tmp_ctx = talloc_new(mem_ctx); if (tmp_ctx == NULL) return ENOMEM; @@ -610,15 +610,7 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx, goto done; } - svc->name = hostname; - - service_filter = talloc_asprintf(tmp_ctx, - "(objectClass=%s)", - IPA_HBAC_SERVICE_GROUP); - if (service_filter == NULL) { - ret = ENOMEM; - goto done; - } + svc->name = servicename; svc_dn = sysdb_custom_dn(sysdb, tmp_ctx, domain->name, svc->name, HBAC_SERVICES_SUBDIR); @@ -627,46 +619,68 @@ hbac_eval_service_element(TALLOC_CTX *mem_ctx, goto done; } - /* Find the service groups */ - ret = sysdb_asq_search(tmp_ctx, sysdb, domain, svc_dn, - service_filter, SYSDB_MEMBEROF, - attrs, &count, &msgs); - if (ret != EOK && ret != ENOENT) { - DEBUG(1, ("Could not look up servicegroups\n")); + /* Look up the service to get its originalMemberOf entries */ + ret = sysdb_search_entry(tmp_ctx, sysdb, svc_dn, + LDB_SCOPE_BASE, NULL, + memberof_attrs, + &count, &msgs); + if (ret == ENOENT || count == 0) { + /* We won't be able to identify any groups + * This rule will only match the name or + * a service category of ALL + */ + svc->groups = NULL; + ret = EOK; goto done; - } else if (ret == ENOENT) { - count = 0; + } else if (ret != EOK) { + goto done; + } else if (count > 1) { + DEBUG(1, ("More than one result for a BASE search!\n")); + ret = EIO; + goto done; + } + + el = ldb_msg_find_element(msgs[0], SYSDB_ORIG_MEMBEROF); + if (!el) { + /* Service is not a member of any groups + * This rule will only match the name or + * a service category of ALL + */ + svc->groups = NULL; + ret = EOK; } - svc->groups = talloc_array(svc, const char *, count + 1); + + svc->groups = talloc_array(svc, const char *, el->num_values + 1); if (svc->groups == NULL) { ret = ENOMEM; goto done; } - for (i = 0; i < count; i++) { - group_name = ldb_msg_find_attr_as_string(msgs[i], IPA_CN, NULL); - if (group_name == NULL) { - DEBUG(1, ("Group with no name?\n")); - ret = EINVAL; - goto done; - } - svc->groups[i] = talloc_strdup(svc->groups, - group_name); - if (svc->groups[i] == NULL) { - ret = ENOMEM; - goto done; - } + for (i = j = 0; i < el->num_values; i++) { + ret = get_ipa_servicegroupname(tmp_ctx, sysdb, + (const char *)el->values[i].data, + &name); + if (ret != EOK && ret != ENOENT) goto done; - DEBUG(6, ("Added service group [%s] to the eval request\n", - svc->groups[i])); + /* ENOENT means we had a memberOf entry that wasn't a + * service group. We'll just ignore those (could be + * HBAC rules) + */ + + if (ret == EOK) { + svc->groups[j] = talloc_steal(svc->groups, name); + j++; + } } - svc->groups[i] = NULL; + svc->groups[j] = NULL; - *svc_element = talloc_steal(mem_ctx, svc); ret = EOK; done: + if (ret == EOK) { + *svc_element = talloc_steal(mem_ctx, svc); + } talloc_free(tmp_ctx); return ret; } diff --git a/src/providers/ipa/ipa_hbac_private.h b/src/providers/ipa/ipa_hbac_private.h index 7289a042..4c637aa5 100644 --- a/src/providers/ipa/ipa_hbac_private.h +++ b/src/providers/ipa/ipa_hbac_private.h @@ -157,6 +157,11 @@ hbac_service_attrs_to_rule(TALLOC_CTX *mem_ctx, const char *rule_name, struct sysdb_attrs *rule_attrs, struct hbac_rule_element **services); +errno_t +get_ipa_servicegroupname(TALLOC_CTX *mem_ctx, + struct sysdb_ctx *sysdb, + const char *service_dn, + char **servicename); /* From ipa_hbac_rules.c */ struct tevent_req * diff --git a/src/providers/ipa/ipa_hbac_services.c b/src/providers/ipa/ipa_hbac_services.c index df276b86..d5390e51 100644 --- a/src/providers/ipa/ipa_hbac_services.c +++ b/src/providers/ipa/ipa_hbac_services.c @@ -449,3 +449,112 @@ done: talloc_free(tmp_ctx); return ret; } + +errno_t +get_ipa_servicegroupname(TALLOC_CTX *mem_ctx, + struct sysdb_ctx *sysdb, + const char *service_dn, + char **servicegroupname) +{ + errno_t ret; + struct ldb_dn *dn; + const char *rdn_name; + const char *svc_comp_name; + const char *hbac_comp_name; + const struct ldb_val *rdn_val; + const struct ldb_val *svc_comp_val; + const struct ldb_val *hbac_comp_val; + + /* This is an IPA-specific hack. It may not + * work for non-IPA servers and will need to + * be changed if SSSD ever supports HBAC on + * a non-IPA server. + */ + *servicegroupname = NULL; + + dn = ldb_dn_new(mem_ctx, sysdb_ctx_get_ldb(sysdb), service_dn); + if (dn == NULL) { + ret = ENOMEM; + goto done; + } + + if (!ldb_dn_validate(dn)) { + ret = EINVAL; + goto done; + } + + if (ldb_dn_get_comp_num(dn) < 4) { + /* RDN, services, hbac, and at least one DC= */ + /* If it's fewer, it's not a group DN */ + ret = ENOENT; + goto done; + } + + /* If the RDN name is 'cn' */ + rdn_name = ldb_dn_get_rdn_name(dn); + if (rdn_name == NULL) { + /* Shouldn't happen if ldb_dn_validate() + * passed, but we'll be careful. + */ + ret = EINVAL; + goto done; + } + + if (strcasecmp("cn", rdn_name) != 0) { + /* RDN has the wrong attribute name. + * It's not a service. + */ + ret = ENOENT; + goto done; + } + + /* and the second component is "cn=hbacservicegroups" */ + svc_comp_name = ldb_dn_get_component_name(dn, 1); + if (strcasecmp("cn", svc_comp_name) != 0) { + /* The second component name is not "cn" */ + ret = ENOENT; + goto done; + } + + svc_comp_val = ldb_dn_get_component_val(dn, 1); + if (strncasecmp("hbacservicegroups", + (const char *) svc_comp_val->data, + svc_comp_val->length) != 0) { + /* The second component value is not "hbacservicegroups" */ + ret = ENOENT; + goto done; + } + + /* and the third component is "hbac" */ + hbac_comp_name = ldb_dn_get_component_name(dn, 2); + if (strcasecmp("cn", hbac_comp_name) != 0) { + /* The third component name is not "cn" */ + ret = ENOENT; + goto done; + } + + hbac_comp_val = ldb_dn_get_component_val(dn, 2); + if (strncasecmp("hbac", + (const char *) hbac_comp_val->data, + hbac_comp_val->length) != 0) { + /* The third component value is not "hbac" */ + ret = ENOENT; + goto done; + } + + /* Then the value of the RDN is the group name */ + rdn_val = ldb_dn_get_rdn_val(dn); + *servicegroupname = talloc_strndup(mem_ctx, + (const char *)rdn_val->data, + rdn_val->length); + if (*servicegroupname == NULL) { + ret = ENOMEM; + goto done; + } + + ret = EOK; + +done: + talloc_free(dn); + return ret; +} -- cgit